dataformat.error we couldn't parse your query string because it was improperly formatted

Ok, 

So the latest on this is that, after a whole lot of learning, I think I know what the issue is, but I can't prove it.

Having successfully proved the OAuth flow using Postman, I learned two important things:

1. That the request to get token (using the "code" returned by the authorize_uri web service as part of the the redirect_url) needs to be embedded in the body of the request, not the header. The code was trying to do this by default, but it's an important point that I'd missed, so thought I'd mention it here.

2. The token provided in response to that request also needs to go in to the header of the web.contents call to get the actual data from the intended endpoint (in this case, the recruit api endpoint) AND The Header Prefix (which is usually "Bearer") expected in the case of this Zoho endpoint, is actually "Zoho-oauthtoken". 

So my question is this:

How can I force the custom connector I've developed to use "Zoho_oauthtoken" as the header prefix? Presumably I cannot simply add Header = [#"Zoho_oauthtoken"] to the web.contents call, as it would be missing the access_token pulled by the TokenMethod function. So am I not stuck in a chicken and egg situation?

Follow on questions:

I can put similar (but vastly reduce) set of program code directly in to the advanced query editor in the Transform Data tool within Power BI desktop similar to this example for twitter here, but when I try to "execute" the step to get the initial "code" from the Authorise_uri, the login page presented for me to allow me to "accept" that I'm giving access to the intended scope won't let me type anything in the window. Does anyone know why this is? Is there a way around it?

Or I can try to write a non "Data connector" template based flow which doesn't rely on StartLogin / FinishLogin, which calls the Auth and Token webservices first, and then uses that token to call the main data (recruit) service. However, again, I don't know how to take the response to the first request to the authorize_Uri, and present this in a browser for me to then respond to....

Oh - and there's a lot of ambiguity in the documentation as to whether or not I actually need a personal mode On premises data gateway to make this work, I've tried it and it doesn't make any difference, but just through I'd ask what the formal position is on this. 

Truly stuck - any help greatly appreciated.

Clno1